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Minutes of Audit & Risk Committee meeting held on 03 Sep 2018 


Present: 

Colin Ledlie (Chair), Non-Executive Director 
Mandy Gallacher, Non-Executive Director 
Bill Matthews, Non-Executive Director 


Asif Haseeb, External Auditor (Audit Scotland) 
Jonny Steen, External Auditor (Audit Scotland) 
Myra Binnie, Internal Auditor 

Dougie Shepherd, Internal Auditor 


Anne Slater, NRS, Acting Chief Executive 

Linda Sinclair, NRS, Director of Strategy & Business Services 
Simon Hazlewood, NRS, Strategy & Business Services 

Angela Sim, NRS, Strategy & Business Services 

Amy Wilson, NRS, Director of Statistical & Registration Services 
David Craig, NRS, Census Programme Director 

Ken Randall, NRS, Census Programme Manager 


Apologies: 
Steven Hanlon, NRS, Chief Financial Officer (acting Accountable Officer) 


1. Committee training 


1.1 Immediately prior to the formal meeting the committee undertook training 
sessions on the revised SG Audit & Assurance Committee Handbook and revised 
SG Whistleblowing policy. Both were well received with thanks given to Billy Wilkie 
(SG Internal Audit Directorate) and Jane Wilson (SG People Advice) respectively. 


2. Declarations of interest 

2.1 There were no declarations of interest. 

3. Matters arising 

3.1 There were no matters arising. 

4. Census 2021 risks — deep-dive presentation 

4.1 David Craig (DC) and Ken Randall (KR) delivered a presentation to the 
committee setting out the current position on the 2021 Census programme in the 


context of: 


e Programme status (Amber) 
e Governance landscape and how this has changed 
e Assurance regime including OCIO, Gateway, Technology Assurance 
Framework and Internal Audit 
e Risk Management Framework refresh of approach, governance and process 
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e Six key risks and associated mitigation plans 


4.2 The committee noted the current activity to refresh the governance landscape 
and highlighted the need to ensure that this was works effectively, and in particular 
that the re-scoping of the Sponsoring Board is successful given issues with the 
effectiveness of this forum in the previous governance set up. 


4.3 The committee noted that the key objectives of the programme had been 
restated and that a high level plan for the census would be published in October in the 
form of a Government Statement which would include a proposed question set. The 
committee advised that this should be shared with the NRS Strategy Board. 


4.4 Looking ahead to the census rehearsal in 2019 the committee were satisfied 
that while specific plans on what will be in scope have still to be confirmed, the 
programme had identified risks around a) integration of solutions and b) introduction 
of new process from the last census design (targeting 80% online completion, and a 
more flexible field force approach) and that these would be tested. 


4.5 In summary, the committee welcomed the strengthening of governance 
controls and new risk management framework but confirmed it would need strong 
assurance from the programme that these have been embedded successfully and 
are operating effectively across the programme. It was agreed that a subsequent 
follow-up to this initial deep-dive should be added to the committee Forward Look for 
February 2019. 


Action: Simon Hazlewood to add a follow-up census deep dive to the Forward 
Look for February 2019. 


5. Minutes and Actions 


5.1 One minor amendment was agreed to section 6.1 of the minutes of the May 
2018 meeting. There were no outstanding actions. 


6. NRS Update Report 


6.1 Anne Slater (AS) confirmed that the recruitment process for NRS Chief 
Executive role was still ongoing. With regard to other key vacancies, AS confirmed 
that all Director level posts have now been filled and that recruitment of other Band C 
posts was progressing well with 13 already filled and a further 7 underway. 


6.2 AS also confirmed that the extension of the lease for Ladywell House has been 
approved by the Cabinet Secretary for Finance. 


7. Governance Statement 2017-18 
7.1 Angela Sim (ASM) presented a final version of the Governance Report following 


the draft in May 2018 which the committee had reviewed and commented on. The 
committee confirmed its approval of this final version. 
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7.2 The Committee noted the final version of the Annual Report & Accounts for 
which there were no further comments or questions with the Chair noting that the 
Committee had previously reviewed and provided comments on earlier drafts of the 
document. 


8. External Audit Annual Report and ISA covering letter/ NRS Annual 
Report & Accounts 2017-18 


8.1 Asif Haseeb (AH) confirmed completion of Audit Scotland’s work on NRS 2017- 
18 Annual Report & Accounts and that subject to NRS Accountable Officer providing 
1) signed letter of representation and 2) signed copy of the annual report and accounts, 
Audit Scotland were able to provide an unqualified audit opinion. 


8.2 Jonny Steen (JS) then took the committee through a summary of the work 
undertaken by Audit Scotland to arrive at this unqualified audit opinion, highlighting 
key messages, areas of good practice and where recommendations for 
improvements had been made in relation to: 


Accounting for non-current assets 
Heritage assets 

Contingent liabilities 

Performance indicators 

NRS website 


8.3 The committee were satisfied that management had provided Audit Scotland 
with action plans against each of these recommendations, and noted that the 
contingent liability with regard to proceedings raised by a third party for a contract 
awarded by NRS in 2017/18 had now been closed following information received by 
legal advisors that no further proceedings will be taken by the third party. 


8.4 With regard to medium to long term financial planning, Audit Scotland had 
advised that management consider expanding their budget forecasts up to a 5-year 
period including scenario planning, which some other public sector organisations are 
forecasting at a high level. The Committee noted and accepted management’s view 
that whilst this was a potentially desirable outcome to work towards in the long term it 
wasn’t currently an immediate priority. 


8.5 On the question of impact of EU withdrawal, Myra Binnie (MB) confirmed that 
Internal Audit had completed some work on this with another body that they would be 
happy to share with management. 


Action: Myra Binnie to share information on work carried out with another body 
in relation to impact of EU withdrawal. 


8.6 In conclusion of this discussion the committee confirmed its acceptance of the 
NRS Annual Report & Accounts for 2017-18. The Committee thanked Audit Scotland 
and the NRS Finance team for the quality and efficiency of their work over the past 
year. 
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9. Finance Report 


9.1 ASM gave the committee a summary of the key points from the 2018-19 budget 
position, highlighting a forecast £0.4m underspend for the year to date, reducing NRS 
starting position of £0.45m over-commitment to a projected £0.05m over-commitment 
for the full year. 


9.2 NRS has work to do to get a clearer picture on capital spend for this year, but 
work is in progress to clarify and confirm options around estates and IT projects to fully 
inform the scale and profile of capital spend for the year. The intention is to wrap all 
capital spend into a programme structure to aid the review, reporting and management 
of all capital spending. 


9.3 ASM highlighted 5 key financial risks that the Executive Management Board will 
monitor in-year, these related to: 


Staff costs 

Census 2021 

Digital Preservation Programme 
IT services 

Income 


9.4 Linda Sinclair (LS) confirmed that a new dedicated census finance manager 
post had been created which would help bring improved local control and forecasting 
to the programme. She also confirmed that a senior procurement / commercial 
specialist post will be advertised w/c 10 September which will help to manage supplier 
integration. 


10. Governance Report 


10.1 Simon Hazlewood (SDH) highlighted work with performance management and 
identification of Key Performance Indicators for NRS is ongoing with the plan to test 
and implement a new reporting framework in time for the 2019-20 financial year. 


10.2 NRS Executive Management Board will have a risk workshop on 18 Sep at 
which they will carry out a review of all corporate risks to ensure the risk landscape 
reflects NRS direction of travel in terms of our longer term business strategy and new 
operating model. A review into NRS approach to risk and issue management is also 
planned. 


10.3 A review into NRS workforce planning approach is currently underway with an 
intention to identify and develop a revised approach that will better support our rolling 
5 year business strategy. NRS will engage with SG colleagues on scope of a similar 
review currently underway to see where NRS approach could be influenced. 


10.4 Mandy Gallacher (MG) highlighted that the mitigation action set against NRS 
People risk perhaps did not reflect that this was our highest (Red) risk. LS confirmed 
that this will be looked at as part of the forthcoming risk workshop, and the committee 
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agreed to pick this point up again as part of the People deep-dive on the Forward Look 
for November. 


10.5 MG questioned whether staff training on fraud for those with any level of 
delegated financial responsibility would be recommended (as stated in section 4.1) or 
mandatory. SDH undertook to confirm with Steven Hanlon as NRS Counter Fraud 
Officer. 


Action: Simon Hazlewood to confirm with Steven Hanlon intentions for staff 
training on fraud (recommended or mandatory). 


11. Audit recommendations report 


11.1 The committee noted progress made with implementing recommendations 
from audit reviews but noted that the description of NRS response to the budget 
management recommendation on achieving the 3% efficiency statement could be 
made more specific. 


11.2 SDH confirmed that while good progress had been made with individual 
recommendations, he had also discussed recently with internal audit colleagues how 
to improve the process around management’s acceptance of recommendations and 
the setting of clear actions plans, realistic delivery milestones and agreement on 
evidence required to avoid issues later down the line with delays and ambiguity on 
what is expected. 


11.3 The committee noted the proximity of the next People Survey and the 
Opportunity to wrap up any outstanding work in relation to recommendations from the 
People Engagement review. 


12. Internal Audit Annual Assurance Report (NRS) 


12.1 MB summarised the main findings in the report confirming a Reasonable 
Assurance opinion for NRS on risk management, control and governance 
arrangements following reviews in 2017-18 on: 


e IT Security Events & GDPR preparations 
e Budget Management Arrangements 
e Risk Management Arrangements (2021 Census programme) 


12.2 Dougie Shepherd (DS) provided a brief update on progress with the audit plan 
for 2018-19 and that work was progressing well at this stage. 


12.3 The original plan included three reviews on 2021 Census, Estates Strategy and 
Workforce Planning, but agreement had been reached with NRS that timing of the 
planned review on the Estates Strategy would it better in 2019-20 than this year. MB 
confirmed that while this would mean that there would be just two reviews carried out 
in 2018-19, the depth of these would still be sufficient for Internal Audit to provide an 
annual assurance opinion. 
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12.4 The scope of the planned review of the 2021 Census programme had still to be 
agreed with Internal Audit in discussions with both NRS and OCIO on what would be 
helpful with some initial suggestions around finance, resources, workforce planning. 
The workforce planning review is due in later in the year (QTR4) and full scope will 
confirmed nearer the time. 


12.5 MB provided a summary of the Internal Audit’s Annual Report 2017-18 to 
SGAAC which included a response to the review carried out by Audit Scotland 
Overview of Internal Audit 2017-18. MB confirmed that Internal Audit have identified 
a number of improvements across their approach and that work was in progress to 
implement these in the following areas: 


Development and rollout of a revised Internal Audit Manual 
Better documenting of working papers 

Reporting on conformance with code of Ethics 
Non-compliance with PSIAS and Internal Audit Manual 


eee o 


13. Committee Annual Report 2017-18 


13.1 There were no further changes identified to the draft tabled in May and 
committee agreed this could be signed off. 


Action — Simon Hazlewood to publish final version of Committee Annual Report 
2017-18 on NRS website 


14. Committee terms of reference 


14.1 SDH confirmed these had been re-drafted to take into account the revised SG 
Audit and Assurance Committee Handbook which had led to a better description of 
the committee responsibilities, highlighted the training element and made provision 
for an additional progress check in November each year on Audit Scotland 
recommendations. 


14.2 One further key change was to reduce the quorate from three to two members. 
MG raised some concern on the risk that this exposed the committee to and that further 
recruitment to the committee would help to mitigate this risk. This point was picked up 
again under the Self-Assessment agenda item. 


14.3 AH asked that the section on responsibilities be amended to make clearer the 
committee’s role with regard to the NRS Annual Report and Accounts. A similar point 
was made to expand on the committee’s role in providing assurance on corporate 
governance requirements. 


Action: Simon Hazlewood to amend Responsibilities section of the revised 
committee terms of reference to make clearer role around NRS Annual Report & 
Accounts and in providing assurance on corporate governance requirements. 
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15. Committee self-assessment checklist 


15.1 The committee reviewed the responses to each item on the checklist focussing 
on the following five areas requiring confirmation. 


e Membership — It was agreed that a quorum of two was sufficient but that NRS 
should consider succession planning with a view to bringing in additional 
members on a phased basis over time and in readiness for current committee 
membership ceasing in January 2022. 

e Membership — While the Chair has sufficient financial experience to meet the 
requirement, management should seek to appoint an accountant to the 
committee as part of the action above. 

e Co-ordination with other NRS committees — Management to consider and 
report to November meeting on scope / proposals for how the committee might 
engage with other NRS committees. 

e Internal Audit performance measures — The committee agreed that sufficient 
information is available through Internal Audit KPIs measurements. 


16. Forward Look 

The committee accepted the Forward Look proposals, noting the action agreed earlier 
in the meeting to add a follow-up census deep dive to the Forward Look for February 
2019. 

17. Any Other Business 


17.1 There was no other business arising. The next meeting is scheduled for 
Thursday 29 November 2018, Room 1/G/8, Ladywell House. 
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